CVE-2007-6404 Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URI.
MediumCVSS 5.0
EPSS 2.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shttp | <= 1.38 | No fix listed |
References
- aluigi.altervista.org exploit
- 44013 vdb-entry
- 3457 third-party-advisory
- [shttpd-general] 20071203 Security bugs in SHTTPD exploit mailing-list
- 20071207 Two vulnerabilities in Simple HTTPD 1.38 mailing-list
- 26768 exploit vdb-entry
- 4700 exploit